By Firefox 155 dropped September 1 with changes that should move you off the update button now. The headliner: CSS attr() finally works in any property, ending a limitation in place since CSS2 in 1998. Alongside that, Promise.allKeyed arrives for cleaner async patterns, QUIC v2 and Happy Eyeballs v3 cut connection overhead, and Mozilla patched 30 security flaws — 10 of them high severity. This is not a maintenance release.
CSS attr() Is No Longer Locked to content
For 29 years, attr() worked in exactly one place: the content property. Useful for inserting attribute text into pseudo-elements, useless for everything else. Firefox 155 changes that. The function now works in any CSS property, accepts typed values with unit identifiers, and falls back gracefully when the attribute is absent.
The practical upside is significant. You can now build data-driven component styles without touching JavaScript:
/* Before: JS to read the attribute and set the style */
document.querySelectorAll('.progress-bar').forEach(el => {
el.style.width = el.dataset.width + '%';
});
/* After: pure CSS */
.progress-bar {
width: attr(data-width %, 0%);
}This extends to transforms, colors, transitions, view transition names — any property that accepts the relevant type. Dynamic theming from data attributes, design tokens sourced directly from HTML, rotation and sizing values from markup — all without a JS layer. Chrome has supported this since version 124. Safari does not yet, which means production use still requires progressive enhancement or a polyfill. But the path is clear.
Also shipping in Firefox 155: the alpha() function, which lets you modify a color’s transparency without touching its other channels:
:root {
--brand: #1a73e8;
}
.overlay {
/* 50% transparent variant of --brand, no value duplication */
background: alpha(from var(--brand) / 50%);
}Paired with CSS custom properties, this eliminates one of the more tedious patterns in design systems — maintaining a separate rgba() value every time you need a transparency variant of a token. The progress() function also ships: it computes a ratio between two values, which you can feed into calc() for responsive property interpolation. Full details in the MDN CSS attr() documentation.
Promise.allKeyed: The Async Fix You Didn’t Know You Needed
Promise.all([]) is order-dependent. That sounds fine until someone refactors the array and destructuring breaks silently — wrong variable gets wrong data, no error thrown. It’s the kind of bug that shows up in a code review two months later.
Promise.allKeyed, now shipping in Firefox 155 without flags, takes an object and returns an object with the same keys:
// Fragile: breaks if array order changes
const [user, company, stats] = await Promise.all([
fetchUser(id),
fetchCompany(id),
fetchStats(id),
]);
// Resilient: name-bound, order doesn't matter
const { user, company, stats } = await Promise.allKeyed({
user: fetchUser(id),
company: fetchCompany(id),
stats: fetchStats(id),
});Promise.allSettledKeyed is the parallel for error handling — it resolves with an object of status/value or status/reason records keyed by name. The TC39 “Await Dictionary” proposal hit Stage 3 at the July 2026 plenary. Firefox is shipping it first; Chrome support is pending. Use a polyfill if you need cross-browser support today.
30 Security Fixes — Patch Now
Thirty CVEs in one release is a lot. Mozilla’s security advisory MFSA 2026-82 documents 29 individual vulnerabilities plus four summary entries covering internally discovered bugs. Ten are rated high severity, including several use-after-free flaws with sandbox-escape potential. UAF bugs in browsers are routinely exploited in the wild — this is not academic risk.
Firefox ESR 140.15 was updated in parallel. If you manage enterprise deployments, verify the ESR version is current too.
Faster Connections Without Configuration
Two networking upgrades ship together. Happy Eyeballs v3 expands on the original IPv4/IPv6 parallel connection attempt to also try HTTP/2 and HTTP/3 simultaneously, using whichever succeeds first. On networks with broken IPv6 or unavailable HTTP/3 endpoints — which is more common than it should be — this cuts wasted time on failed connections before falling back.
QUIC v2 support (RFC 9369) lands for HTTP/3 connections. QUIC v2 is functionally identical to v1 but changes version codepoints and negotiation labels, preventing middlebox ossification as the protocol evolves. Firefox will use it when a server selects it via compatible version negotiation — no configuration needed on your end.
WebAssembly also gets two new proposals: the Compact Import Section (smaller .wasm bundles for import-heavy modules) and Wide Arithmetic (128-bit instructions for cryptography and arbitrary-precision math). Full release notes are on MDN.
The New Cadence
Firefox 155 is the first release under Mozilla’s new two-week experiment, replacing the previous monthly schedule. Firefox 154 was the last monthly on August 18. Firefox 156 is expected around September 15. The practical benefit for everyone is faster security patches — 30 CVEs that used to wait a month now ship in two weeks. For developers tracking platform changes, the pace picks up: more frequent MDN release notes to check.
The CSS and JavaScript changes in Firefox 155 are platform progress worth paying attention to. attr() as a universal CSS function changes how much styling work you can do declaratively. Promise.allKeyed is the kind of small API that prevents a specific class of subtle bug. Ship the security update today; explore the new features this week.
